<?php

/*
	vpn.inc
	Copyright (C) 2004 Scott Ullrich
	Copyright (C) 2008 Shrew Soft Inc
	Copyright (C) 2008 Ermal Lu�i
	All rights reserved.

	originally part of m0n0wall (http://m0n0.ch/wall)
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
	All rights reserved.

	Redistribution and use in source and binary forms, with or without
	modification, are permitted provided that the following conditions are met:

	1. Redistributions of source code must retain the above copyright notice,
	   this list of conditions and the following disclaimer.

	2. Redistributions in binary form must reproduce the above copyright
	   notice, this list of conditions and the following disclaimer in the
	   documentation and/or other materials provided with the distribution.

	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	POSSIBILITY OF SUCH DAMAGE.
*/

/*
	pfSense_BUILDER_BINARIES:	/sbin/ifconfig
	pfSense_BUILDER_BINARIES:	/usr/local/sbin/ipsec	/usr/local/libexec/ipsec/charon /usr/local/libexec/ipsec/starter
	pfSense_BUILDER_BINARIES:	/usr/local/sbin/filterdns	/usr/local/sbin/mpd4
	pfSense_MODULE:	vpn
*/

require_once("ipsec.inc");

function vpn_ipsec_configure_loglevels($forconfig = false)
{
	global $config, $ipsec_loglevels;

	$cfgtext = array();
	foreach ($ipsec_loglevels as $lkey => $ldescr) {
		if (!isset($config['ipsec']["ipsec_{$lkey}"]) && !$forconfig)
			mwexec("/usr/local/sbin/ipsec stroke loglevel {$lkey} -- -1", false);
		else if (is_numeric($config['ipsec']["ipsec_{$lkey}"]) &&
		    intval($config['ipsec']["ipsec_{$lkey}"]) >= 0 && intval($config['ipsec']["ipsec_{$lkey}"]) <= 5)
			$forconfig ? $cfgtext[] = "${lkey} " . (intval($config['ipsec']["ipsec_{$lkey}"]) - 1) :
				mwexec("/usr/local/sbin/ipsec stroke loglevel {$lkey} " . (intval($config['ipsec']["ipsec_{$lkey}"]) - 1) , false);
	}
	if ($forconfig)
		return implode(',', $cfgtext);
}

/* include all configuration functions */
function vpn_ipsec_convert_to_modp($index)
{

	$convertion = "";
	switch ($index) {
	case '1':
		$convertion = "modp768";
		break;
	case '2':
		$convertion = "modp1024";
		break;
	case '5':
		$convertion = "modp1536";
		break;
	case '14':
		$convertion = "modp2048";
		break;
	case '15':
		$convertion = "modp3072";
		break;
	case '16':      
		$convertion = "modp4096";
		break;
	case '17':
		$convertion = "modp6144";
		break;
	case '18':
		$convertion = "modp8192";
		break;
	}

	return $convertion;
}

function vpn_ipsec_configure($ipchg = false)
{
	global $config, $g, $sa, $sn, $p1_ealgos, $p2_ealgos;

<<<<<<< HEAD
	if ($g['platform'] == 'jail')
		return;
=======
	if(is_process_running("sasyncd"))
		mwexec("killall sasyncd", true);
>>>>>>> FETCH_HEAD

	/* get the automatic ping_hosts.sh ready */
	unlink_if_exists("{$g['vardb_path']}/ipsecpinghosts");
	touch("{$g['vardb_path']}/ipsecpinghosts");

	vpn_ipsec_configure_preferoldsa();

	$syscfg = $config['system'];
	$ipseccfg = $config['ipsec'];
	if (!isset($ipseccfg['enable'])) {
		/* try to stop charon */
		mwexec("/usr/local/sbin/ipsec stop");
		/* Stop dynamic monitoring */
		killbypid("{$g['varrun_path']}/filterdns-ipsec.pid");

<<<<<<< HEAD
		/* wait for process to die */
		sleep(2);

		/* disallow IPSEC, it is off */
		mwexec("/sbin/ifconfig enc0 down");
		set_single_sysctl("net.inet.ip.ipsec_in_use", "0");

		filter_configure();
=======
	mwexec("/sbin/ifconfig enc0 create", true);
	mwexec("/sbin/ifconfig enc0 up", true);
	
	exec("/sbin/sysctl net.enc.out.ipsec_bpf_mask=0x00000001");
	exec("/sbin/sysctl net.enc.out.ipsec_filter_mask=0x00000001");
	exec("/sbin/sysctl net.enc.in.ipsec_bpf_mask=0x00000002");
	exec("/sbin/sysctl net.enc.in.ipsec_filter_mask=0x00000002");

	/* get the automatic /etc/ping_hosts.sh ready */
	unlink_if_exists("/var/db/ipsecpinghosts");
	touch("/var/db/ipsecpinghosts");

	if(isset($config['ipsec']['preferoldsa'])) {
		mwexec("/sbin/sysctl net.key.preferred_oldsa=0");
	} else {
		mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30");
	}
>>>>>>> FETCH_HEAD

		return 0;
	}

	$a_phase1 = $config['ipsec']['phase1'];
	$a_phase2 = $config['ipsec']['phase2'];
	$a_client = $config['ipsec']['client'];

	$certpath = "{$g['varetc_path']}/ipsec/ipsec.d/certs";
	$capath = "{$g['varetc_path']}/ipsec/ipsec.d/cacerts";
	$keypath = "{$g['varetc_path']}/ipsec/ipsec.d/private";

<<<<<<< HEAD
	mwexec("/sbin/ifconfig enc0 up");
	set_single_sysctl("net.inet.ip.ipsec_in_use", "1");
	/* needed for config files */
	if (!is_dir("{$g['varetc_path']}/ipsec"))
		mkdir("{$g['varetc_path']}/ipsec");
	if (!is_dir("{$g['varetc_path']}/ipsec/ipsec.d"))
		mkdir("{$g['varetc_path']}/ipsec/ipsec.d");
	if (!is_dir($capath))
		mkdir($capath);
	if (!is_dir($keypath))
		mkdir($keypath);
	if (!is_dir("{$g['varetc_path']}/ipsec/ipsec.d/crls"))
		mkdir("{$g['varetc_path']}/ipsec/ipsec.d/crls");
	if (!is_dir($certpath))
		mkdir($certpath);
	if (!is_dir("{$g['varetc_path']}/ipsec/ipsec.d/aacerts"))
		mkdir("{$g['varetc_path']}/ipsec/ipsec.d/aacerts");
	if (!is_dir("{$g['varetc_path']}/ipsec/ipsec.d/acerts"))
		mkdir("{$g['varetc_path']}/ipsec/ipsec.d/acerts");
	if (!is_dir("{$g['varetc_path']}/ipsec/ipsec.d/ocspcerts"))
		mkdir("{$g['varetc_path']}/ipsec/ipsec.d/ocspcerts");
	if (!is_dir("{$g['varetc_path']}/ipsec/ipsec.d/reqs"))
		mkdir("{$g['varetc_path']}/ipsec/ipsec.d/reqs");
	

	if (platform_booting())
		echo gettext("Configuring IPsec VPN... ");

	/* fastforwarding is not compatible with ipsec tunnels */
	set_single_sysctl("net.inet.ip.fastforwarding", "0");

	/* resolve all local, peer addresses and setup pings */
	$ipmap = array();
	$rgmap = array();
	$filterdns_list = array();
	$listeniflist = array();
	$aggressive_mode_psk = false;
	unset($iflist);
	$ifacesuse = array();
	if (is_array($a_phase1) && count($a_phase1)) {

		$ipsecpinghosts = "";
		/* step through each phase1 entry */
		foreach ($a_phase1 as $ph1ent) {
			if (isset($ph1ent['disabled']))
				continue;

			if (strpos($ph1ent['interface'], '_vip')) {
				$vpninterface = explode('_vip', $ph1ent['interface']);
				$ifacesuse[] = get_real_interface($vpninterface[0]);
                        } else {
                                $vpninterface = get_failover_interface($ph1ent['interface']);
				if (!empty($vpninterface))
					$ifacesuse[] = $vpninterface;
			}
				
			if ($ph1ent['mode'] == "aggressive" && ($ph1ent['authentication_method'] == "pre_shared_key" || $ph1ent['authentication_method'] == "xauth_psk_server")) 
				$aggressive_mode_psk = true;

			$ikeid = $ph1ent['ikeid'];
			$listeniflist = get_real_interface($a_phase1['interface']);
=======
	if (!isset($ipseccfg['enable'])) {
		mwexec("/sbin/ifconfig enc0 down");
		mwexec("/sbin/ifconfig enc0 destroy");

		/* kill racoon */
		if(is_process_running("racoon"))
			mwexec("/usr/bin/killall racoon", true);
		killbypid("{$g['varrun_path']}/dnswatch-ipsec.pid");

>>>>>>> FETCH_HEAD

			$ep = ipsec_get_phase1_src($ph1ent);
			if (!is_ipaddr($ep))
				continue;

<<<<<<< HEAD
			if(!in_array($ep,$ipmap))
				$ipmap[] = $ep;

			/* see if this tunnel has a hostname for the remote-gateway. If so,
			   try to resolve it now and add it to the list for filterdns */
=======
		/* send a SIGKILL to be sure */
		sigkillbypid("{$g['varrun_path']}/racoon.pid", "KILL");

		/* flush SPD and SAD */
		mwexec("/usr/local/sbin/setkey -FP");
		mwexec("/usr/local/sbin/setkey -F");

		return true;
	}

	if ($g['booting']) {
		echo "Configuring IPsec VPN... ";
	}
>>>>>>> FETCH_HEAD

			if (isset ($ph1ent['mobile']))
				continue;

<<<<<<< HEAD
			$rg = $ph1ent['remote-gateway'];
=======
		/* fastforwarding is not compatible with ipsec tunnels */
		mwexec("/sbin/sysctl net.inet.ip.fastforwarding=0");
>>>>>>> FETCH_HEAD

			if (!is_ipaddr($rg)) {
				$filterdns_list[] = "{$rg}";
				add_hostname_to_watch($rg);
				if (!platform_booting())
					$rg = resolve_retry($rg);
				if (!is_ipaddr($rg))
					continue;
			}
			if(array_search($rg, $rgmap)) {
				log_error("The remote gateway {$rg} already exists on another phase 1 entry");
				continue;
			}
			$rgmap[$ph1ent['remote-gateway']] = $rg;

<<<<<<< HEAD
			if (is_array($a_phase2)) {
				/* step through each phase2 entry */
				foreach ($a_phase2 as $ph2ent) {
					if (isset($ph2ent['disabled']))
						continue;

					if ($ikeid != $ph2ent['ikeid'])
						continue;
=======
		/* this loads a route table which is used to determine if a route needs to be removed. */
		exec("/usr/bin/netstat -rn", $route_arr, $retval);
		$route_str = implode("\n", $route_arr);

		if ((is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) ||
				isset($ipseccfg['mobileclients']['enable'])) {

			$dnswatch_list = array();
			$rgmap = array();

			if (is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) {
>>>>>>> FETCH_HEAD

					/* add an ipsec pinghosts entry */
					if ($ph2ent['pinghost']) {
						if (!is_array($iflist))
							$iflist = get_configured_interface_list();
						$srcip = null;
						$local_subnet = ipsec_idinfo_to_cidr($ph2ent['localid'], true, $ph2ent['mode']);
						if(is_ipaddrv6($ph2ent['pinghost'])) {
							foreach ($iflist as $ifent => $ifname) {
								$interface_ip = get_interface_ipv6($ifent);
								if(!is_ipaddrv6($interface_ip))
									continue;
								if (ip_in_subnet($interface_ip, $local_subnet)) {
									$srcip = $interface_ip;
									break;
								}
							}
						} else {
							foreach ($iflist as $ifent => $ifname) {
								$interface_ip = get_interface_ip($ifent);
								if(!is_ipaddrv4($interface_ip))
									continue;
								if ($local_subnet == "0.0.0.0/0" || ip_in_subnet($interface_ip, $local_subnet)) {
									$srcip = $interface_ip;
									break;
								}
							}
						}
						/* if no valid src IP was found in configured interfaces, try the vips */
						if (is_null($srcip)) {
							$viplist = get_configured_vips_list();
							foreach ($viplist as $vip) {
								if (ip_in_subnet($vip['ipaddr'], $local_subnet)) {
									$srcip = $vip['ipaddr'];
									break;
								}
							}
						}
						$dstip = $ph2ent['pinghost'];
						if(is_ipaddrv6($dstip)) {
							$family = "inet6";
						} else {
							$family = "inet";
						}
						if (is_ipaddr($srcip))
							$ipsecpinghosts[] = "{$srcip}|{$dstip}|3|||||{$family}|\n";
					}
				}
			}
		}
		@file_put_contents("{$g['vardb_path']}/ipsecpinghosts", $ipsecpinghosts);
		unset($ipsecpinghosts);
	}
	unset($iflist);

	$accept_unencrypted = "";
	if (isset($config['ipsec']['acceptunencryptedmainmode']))
		$accept_unencrypted = "accept_unencrypted_mainmode_messages = yes";

	$i_dont_care_about_security_and_use_aggressive_mode_psk = "";
	if ($aggressive_mode_psk) {
		log_error("WARNING: Setting i_dont_care_about_security_and_use_aggressive_mode_psk option because a phase 1 is configured using aggressive mode with pre-shared keys. This is not a secure configuration.");
		$i_dont_care_about_security_and_use_aggressive_mode_psk = "i_dont_care_about_security_and_use_aggressive_mode_psk=yes";
	} 

	$unity_enabled = 'yes';
	if (isset($config['ipsec']['unityplugin']))
		$unity_enabled = 'no';

	if (!empty($ifacesuse))
		$ifacesuse = 'interfaces_use = ' . implode(',', array_unique($ifacesuse));
	else
		$ifacesuse = '';

<<<<<<< HEAD
	$strongswan = <<<EOD

# Automatically generated config file - DO NOT MODIFY. Changes will be overwritten. 
starter {
load_warning = no
}

charon {
# number of worker threads in charon
threads = 16
ikesa_table_size = 32
ikesa_table_segments = 4
init_limit_half_open = 1000
install_routes = no
{$i_dont_care_about_security_and_use_aggressive_mode_psk}
{$accept_unencrypted}
cisco_unity = {$unity_enabled}
{$ifacesuse}

# And two loggers using syslog. The subsections define the facility to log
# to, currently one of: daemon, auth.
syslog {
	identifier = charon
	# default level to the LOG_DAEMON facility
	daemon {
	}
	# very minimalistic IKE auditing logs to LOG_AUTHPRIV
	auth {
		default = -1
		ike = 1
		ike_name = yes
	}
}

EOD;

	$strongswan .= "\tplugins {\n";

	if (is_array($a_client) && isset($a_client['enable'])) {
		$strongswan .= "\t\tattr {\n";
		if ($a_client['pool_address'] && $a_client['pool_netbits'])
			$strongswan .= "\t\t\tsubnet = {$a_client['pool_address']}/{$a_client['pool_netbits']}\n";

		$cfgservers = array();
		if (!empty($a_client['dns_server1']))
			$cfgservers[] = $a_client['dns_server1'];
		if (!empty($a_client['dns_server2']))
			$cfgservers[] = $a_client['dns_server2'];
		if (!empty($a_client['dns_server3']))
			$cfgservers[] = $a_client['dns_server3'];
		if (!empty($a_client['dns_server4']))
			$cfgservers[] = $a_client['dns_server4'];

		if (!empty($cfgservers))
			$strongswan .= "\t\t\tdns = " . implode(",", $cfgservers) . "\n";
		unset($cfgservers);
		$cfgservers = array();
		if (!empty($a_client['wins_server1']))
			$cfgservers[] = $a_client['wins_server1'];
		if (!empty($a_client['wins_server2']))
			$cfgservers[] = $a_client['wins_server2'];
		if (!empty($cfgservers))
			$strongswan .= "\t\t\tnbns = " . implode(",", $cfgservers) . "\n";
		unset($cfgservers);

		if (isset($a_client['net_list'])) {
			$net_list = '';
			foreach ($a_phase2 as $ph2ent) {
				if (isset($ph2ent['disabled']))
					continue;
=======
					$ep = vpn_endpoint_determine($tunnel, $curwanip);
					/* see if this tunnel has a hostname for the remote-gateway, and if so,
					 * try to resolve it now and add it to the list for dnswatch */
					if (!is_ipaddr($tunnel['remote-gateway'])) {
						$dnswatch_list[] = $tunnel['remote-gateway'];
						$rgip = resolve_retry($tunnel['remote-gateway']);
						add_hostname_to_watch($tunnel['remote-gateway']);
						if (!$rgip) {
							log_error("Could not deterimine VPN endpoint for {$tunnel['descr']}");
							continue;
						}
					} else {
						$rgip = $tunnel['remote-gateway'];
					}
					$rgmap[$tunnel['remote-gateway']] = $rgip;
					if (!$ep) {
						log_error("Could not deterimine VPN endpoint for {$tunnel['descr']}");
						continue;	
					}


					vpn_localnet_determine($tunnel['local-subnet'], $sa, $sn);

					if(is_domain($tunnel['remote-gateway'])) {
						$tmp = gethostbyname($tunnel['remote-gateway']);
						if($tmp) {
							$tunnel['remote-gateway'] = $tmp;
						}
					}

					/* add entry to host pinger */
					if ($tunnel['pinghost']) {
						$pfd = fopen("/var/db/ipsecpinghosts", "a");
						$iflist = array("lan" => "lan", "wan" => "wan");
				          	for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++)
							$iflist['opt' . $i] = "opt{$i}";

						foreach ($iflist as $ifent => $ifname) {
							$interface_ip = find_interface_ip($config['interfaces'][$ifname]['if']);
							if (ip_in_subnet($interface_ip, $sa . "/" . $sn))
							$srcip = find_interface_ip($config['interfaces'][$ifname]['if']);
						}
						$dstip = $tunnel['pinghost'];
						fwrite($pfd, "$srcip|$dstip|3\n");
						fclose($pfd);
					}
					if(isset($tunnel['creategif'])) {
						$number_of_gifs = find_last_gif_device();
						$number_of_gifs++;
						$curwanip = get_current_wan_address();
>>>>>>> FETCH_HEAD

				if (!isset($ph2ent['mobile']))
					continue;

				$localid = ipsec_idinfo_to_cidr($ph2ent['localid'], true, $ph2ent['mode']);

<<<<<<< HEAD
				if (!empty($net_list))
					$net_list .= ",";
				$net_list .= $localid;
			}

			if (!empty($net_list)) {
				$strongswan .= "\t\t\tsplit-include = {$net_list}\n";
				unset($net_list);
			}
		}

		if (!empty($a_client['dns_domain'])) {
			$strongswan .= "\t\t\t# Search domain and default domain\n";
			$strongswan .= "\t\t\t28674 = {$a_client['dns_domain']}\n";
			if (empty($a_client['dns_split']))
				$strongswan .= "\t\t\t28675 = {$a_client['dns_domain']}";
			$strongswan .= "\n";
		}

		if (!empty($a_client['dns_split'])) {
			$strongswan .= "\t\t\t28675 = {$a_client['dns_split']}\n";
		}

		if (!empty($a_client['login_banner']))
			$strongswan .= "\t\t\t28672 = {$a_client['login_banner']}\n";

		if (isset($a_client['save_passwd']))
			$strongswan .= "\t\t\t28673 = 1\n";

		if ($a_client['pfs_group'])
			$strongswan .= "\t\t\t28679 = {$a_client['pfs_group']}\n";
		$strongswan .= "\t\t}\n";

		if ($a_client['user_source'] != "none") {
			$strongswan .= "\t\txauth-generic {\n";
			$strongswan .= "\t\t\tscript = /etc/inc/ipsec.auth-user.php\n";
			$strongswan .= "\t\t\tauthcfg = ";
			$firstsed = 0;
			$authcfgs = explode(",", $a_client['user_source']);
			foreach ($authcfgs as $authcfg) {
				if ($firstsed > 0)
					$strongswan .= ",";
				if ($authcfg == "system")
					$authcfg = "Local Database";
				$strongswan .= $authcfg;
				$firstsed = 1;
=======
					$spdconf .= "spdadd {$tunnel['remote-subnet']} " .
						"{$sa}/{$sn} any -P in ipsec " .
						"{$tunnel['p2']['protocol']}/tunnel/{$tunnel['remote-gateway']}-" .
						"{$ep}/unique;\n";
				
					/* static route needed? */
					if(preg_match("/^carp/i", $tunnel['interface'])) {
						$parentinterface = link_carp_interface_to_parent($tunnel['interface']);
					} else {
						$parentinterface = $tunnel['interface'];
					}
					if($parentinterface <> "wan") {
						/* add endpoint routes to correct gateway on interface */
						if(interface_has_gateway($parentinterface)) {
							$gatewayip = get_interface_gateway("$parentinterface");
							$interfaceip = $config['interfaces'][$parentinterface]['ipaddr'];
							$subnet_bits = $config['interfaces'][$parentinterface]['subnet'];
							$subnet_ip = gen_subnet("{$interfaceip}", "{$subnet_bits}");
							/* if the remote gateway is in the local subnet, then don't add a route */
							if(! ip_in_subnet($tunnel['remote-gateway'], "{$subnet_ip}/{$subnet_bits}")) {
								if(is_ipaddr($gatewayip)) {
									if($g['debug']) {
										log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$tunnel['remote-gateway']} via {$gatewayip}");
									}
									mwexec("/sbin/route delete -host {$tunnel['remote-gateway']}");
                                                                        mwexec("/sbin/route add -host {$tunnel['remote-gateway']} {$gatewayip}");
								}
							}
						}
					} else {
						if(stristr($route_str, "{$tunnel['remote-gateway']}")) {
							mwexec("/sbin/route delete -host {$tunnel['remote-gateway']}");
						}
					}
				}

				fwrite($fd, $spdconf);
				fclose($fd);
>>>>>>> FETCH_HEAD
			}
			$strongswan .= "\n";
			$strongswan .= "\t\t}\n";
		}
	}

	$strongswan .= "\t}\n}\n";
	@file_put_contents("{$g['varetc_path']}/ipsec/strongswan.conf", $strongswan);
	unset($strongswan);

	/* generate CA certificates files */
	if (is_array($config['ca']) && count($config['ca'])) {
		foreach ($config['ca'] as $ca) {
			if (!isset($ca['crt'])) {
				log_error(sprintf(gettext("Error: Invalid certificate info for %s"), $ca['descr']));
				continue;
			}
			$cert = base64_decode($ca['crt']);
			$x509cert = openssl_x509_parse(openssl_x509_read($cert));
			if (!is_array($x509cert) || !isset($x509cert['hash'])) {
				log_error(sprintf(gettext("Error: Invalid certificate hash info for %s"), $ca['descr']));
				continue;
			}
			$fname = "{$capath}/{$x509cert['hash']}.0.crt";
			if (!@file_put_contents($fname, $cert)) {
				log_error(sprintf(gettext("Error: Cannot write IPsec CA file for %s"), $ca['descr']));
				continue;
			}
			unset($cert);
		}
	}

<<<<<<< HEAD
	$pskconf = "";
=======
			$racoonconf = "# This file is automatically generated. Do not edit\n";
			$racoonconf .= "listen {\n";
			$racoonconf .= "	adminsock \"/var/db/racoon/racoon.sock\" \"root\" \"wheel\" 0660;\n";
			$racoonconf .= "}\n";

			$racoonconf .= "path pre_shared_key \"{$g['varetc_path']}/psk.txt\";\n\n";
			$racoonconf .= "path certificate  \"{$g['varetc_path']}\";\n\n";

			/* generate CA certificates files */
			$cacertnum = 0;
			if (is_array($ipseccfg['cacert']) && count($ipseccfg['cacert']))
				foreach ($ipseccfg['cacert'] as $cacert) {
					++$cacertnum;
					if (isset($cacert['cert'])) {
						$cert = base64_decode($cacert['cert']);
						$x509cert = openssl_x509_parse(openssl_x509_read($cert));
						if(is_array($x509cert) && isset($x509cert['hash'])) {
							$fd1 = fopen("{$g['varetc_path']}/{$x509cert['hash']}.0", "w");
							if (!$fd1) {
								printf("Error: cannot open {$x509cert['hash']}.0 in vpn.\n");
								return 1;
							}
							chmod("{$g['varetc_path']}/{$x509cert['hash']}.0", 0600);
							fwrite($fd1, $cert);
							fclose($fd1);
						}
					}
				}
>>>>>>> FETCH_HEAD

	if (is_array($a_phase1) && count($a_phase1)) {
		foreach ($a_phase1 as $ph1ent) {

			if (isset($ph1ent['disabled']))
				continue;

			if (strstr($ph1ent['authentication_method'], 'rsa') ||
			    in_array($ph1ent['authentication_method'], array('eap-mschapv2', 'eap-tls'))) {
				$certline = '';

				$ikeid = $ph1ent['ikeid'];
				$cert = lookup_cert($ph1ent['certref']);

				if (!$cert) {
					log_error(sprintf(gettext("Error: Invalid phase1 certificate reference for %s"), $ph1ent['name']));
					continue;
				}

				@chmod($certpath, 0600);

<<<<<<< HEAD
				$ph1keyfile = "{$keypath}/cert-{$ikeid}.key";
				if (!file_put_contents($ph1keyfile, base64_decode($cert['prv']))) {
					log_error(sprintf(gettext("Error: Cannot write phase1 key file for %s"), $ph1ent['name']));
=======
				$rgip = $rgmap[$tunnel['remote-gateway']];
				if (!$rgip)
					continue;

				$ep = vpn_endpoint_determine($tunnel, $curwanip);
				if (!$ep)
>>>>>>> FETCH_HEAD
					continue;
				}
				@chmod($ph1keyfile, 0600);

<<<<<<< HEAD
				$ph1certfile = "{$certpath}/cert-{$ikeid}.crt";
				if (!file_put_contents($ph1certfile, base64_decode($cert['crt']))) {
					log_error(sprintf(gettext("Error: Cannot write phase1 certificate file for %s"), $ph1ent['name']));
					@unlink($ph1keyfile);
					continue;
				}
				@chmod($ph1certfile, 0600);
=======
				vpn_localnet_determine($tunnel['local-subnet'], $sa, $sn);

				if (isset($tunnel['p1']['myident']['myaddress'])) {
					$myidentt = "address";
					$myident = $ep;
				} else if (isset($tunnel['p1']['myident']['address'])) {
					$myidentt = "address";
					$myident = $tunnel['p1']['myident']['address'];
				} else if (isset($tunnel['p1']['myident']['fqdn'])) {
					$myidentt = "fqdn";
					$myident = $tunnel['p1']['myident']['fqdn'];
				} else if (isset($tunnel['p1']['myident']['ufqdn'])) {
					$myidentt = "user_fqdn";
					$myident = $tunnel['p1']['myident']['ufqdn'];
 				} else if (isset($tunnel['p1']['myident']['dyn_dns'])) {
					$myidentt = "dyn_dns";
					$myident = gethostbyname($tunnel['p1']['myident']['dyn_dns']);
 				}

				if (!($myidentt == "asn1dn" && $myident == "")) {
					$myident = " \"".$myident."\"";
				}
				
				$nattline = '';
				if (isset($tunnel['natt'])) {
					//$nattline = "nat_traversal on;";
				}

				$dpdline = '';
				if (is_numeric($tunnel['dpddelay'])) {
					$dpdline = "dpd_delay {$tunnel['dpddelay']};";
				}

				if (isset($tunnel['p1']['authentication_method'])) {
					$authmethod = $tunnel['p1']['authentication_method'];
				} else {$authmethod = 'pre_shared_key';}
>>>>>>> FETCH_HEAD

				/* XXX" Traffic selectors? */
				$pskconf .= " : RSA {$ph1keyfile}\n";
			} else {
				list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, 'local');
				list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, 'peer', $rgmap);

				if (empty($peerid_data))
					continue;

				$myid = isset($ph1ent['mobile']) ? trim($myid_data) : "%any";
				$peerid = ($peerid_data != 'allusers') ? trim($peerid_data) : '';
				if (!empty($ph1ent['pre-shared-key'])) {
					if ($myid_type == 'fqdn' && !empty($myid_data))
						$pskconf .= "@{$myid} {$peerid} : PSK 0s" . base64_encode(trim($ph1ent['pre-shared-key'])) . "\n";
					else
						$pskconf .= "{$myid} {$peerid} : PSK 0s" . base64_encode(trim($ph1ent['pre-shared-key'])) . "\n";
				}
			}
		}
	}

	/* Add user PSKs */
	if (is_array($config['system']) && is_array($config['system']['user'])) {
		foreach ($config['system']['user'] as $user) {
			if (!empty($user['ipsecpsk'])) {
				$pskconf .= "%any {$user['name']} : PSK 0s" . base64_encode($user['ipsecpsk']) . "\n";
			}
		}
		unset($user);
	}

	/* add PSKs for mobile clients */
	if (is_array($ipseccfg['mobilekey'])) {
		foreach ($ipseccfg['mobilekey'] as $key) {
			if ($key['ident'] == "allusers")
				$key['ident'] = '%any';
			if (empty($key['type']))
				$key['type'] = 'PSK';
			$pskconf .= "%any {$key['ident']} : {$key['type']} 0s" . base64_encode($key['pre-shared-key']) . "\n";
		}
		unset($key);
	}

	@file_put_contents("{$g['varetc_path']}/ipsec/ipsec.secrets", $pskconf);
	chmod("{$g['varetc_path']}/ipsec/ipsec.secrets", 0600);
	unset($pskconf);

	$natfilterrules = false;
	/* begin ipsec.conf */
	$ipsecconf = "";
	$enablecompression = false;
	if (is_array($a_phase1) && count($a_phase1))  {

		$ipsecconf .= "# This file is automatically generated. Do not edit\n";
		$ipsecconf .= "config setup\n\tuniqueids = yes\n";
		$ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n";

		foreach ($a_phase1 as $ph1ent) {
			if (isset($ph1ent['disabled']))
				continue;

			if ($ph1ent['mode'] == "aggressive")
				$aggressive = "yes";
			else
				$aggressive = "no";

			$ep = ipsec_get_phase1_src($ph1ent);
			if (!$ep)
				continue;

			$ikeid = $ph1ent['ikeid'];
			$keyexchange = "ikev1";
			$passive = "route";
			if (!empty($ph1ent['iketype'])) {
				if ($ph1ent['iketype'] == "ikev2") {
					$keyexchange = "ikev2";
					//$passive = "start";
				} else if ($ph1ent['iketype'] == "auto")
					$keyexchange = "ike";
			}

			if (isset($ph1ent['mobile'])) {
				$right_spec = "%any";
				$passive = 'add';
			} else {
				$right_spec = $ph1ent['remote-gateway'];
				if (is_ipaddr($right_spec))
					$sourcehost = $right_spec;
				else
					$sourcehost = $rgmap['remote-gateway'];

				if ($ph1ent['protocol'] == 'inet') {
					if (strpos($ph1ent['interface'], '_vip')) {
						$vpninterface = explode('_vip', $ph1ent['interface']);
						$ifacesuse = get_real_interface($vpninterface[0]);
						$vpninterface = $vpninterface[0];
					} else {
						$ifacesuse = get_failover_interface($ph1ent['interface']);
						$vpninterface = convert_real_interface_to_friendly_interface_name($ifacesuse);
					}
					
					if (!empty($ifacesuse) && interface_has_gateway($vpninterface)) {
						$gatewayip = get_interface_gateway($vpninterface);
						$interfaceip = get_interface_ip($vpninterface);
						$subnet_bits = get_interface_subnet($vpninterface);
						$subnet_ip = gen_subnetv4($interfaceip, $subnet_bits);
						/* if the remote gateway is in the local subnet, then don't add a route */
						if (!ip_in_subnet($sourcehost, "{$subnet_ip}/{$subnet_bits}")) {
							if (is_ipaddrv4($gatewayip)) {
								// log_error("IPSEC interface is not WAN but {$ifacesuse}, adding static route for VPN endpoint {$rgip} via {$gatewayip}");
								mwexec("/sbin/route change -host {$sourcehost} {$gatewayip}", true);
							}
						}
					}
				} else if ($ph1ent['protocol'] == 'inet6') {
					if (strpos($ph1ent['interface'], '_vip')) {
						$vpninterface = explode('_vip', $ph1ent['interface']);
						$ifacesuse = get_real_interface($vpninterface[0]);
						$vpninterface = $vpninterface[0];
					} else {
						$ifacesuse = get_failover_interface($ph1ent['interface']);
						$vpninterface = convert_real_interface_to_friendly_interface_name($ifacesuse);
					}
					
					if (!empty($ifacesuse) && interface_has_gateway($vpninterface)) {
						$gatewayip = get_interface_gateway_v6($vpninterface);
						$interfaceip = get_interface_ipv6($vpninterface);
						$subnet_bits = get_interface_subnetv6($vpninterface);
						$subnet_ip = gen_subnetv6($interfaceip, $subnet_bits);
						/* if the remote gateway is in the local subnet, then don't add a route */
						if (!ip_in_subnet($sourcehost, "{$subnet_ip}/{$subnet_bits}")) {
							if (is_ipaddrv6($gatewayip)) {
								// log_error("IPSEC interface is not WAN but {$ifacesuse}, adding static route for VPN endpoint {$rgip} via {$gatewayip}");
								mwexec("/sbin/route change -inet6 -host {$sourcehost} {$gatewayip}", true);
							}
						}
					}
				}
<<<<<<< HEAD
			}
=======
				$racoonconf .= <<<EOD
remote {$rgmap[$tunnel['remote-gateway']]} \{
	exchange_mode {$tunnel['p1']['mode']};
	my_identifier {$myidentt}{$myident};
	{$nattline}
	{$certline}
	peers_identifier address {$rgmap[$tunnel['remote-gateway']]};
	initial_contact on;
	{$dpdline}
	ike_frag on;
	support_proxy on;
	proposal_check obey;

	proposal \{
		encryption_algorithm {$tunnel['p1']['encryption-algorithm']};
		hash_algorithm {$tunnel['p1']['hash-algorithm']};
		authentication_method {$authmethod};
		dh_group {$tunnel['p1']['dhgroup']};

EOD;
				if ($tunnel['p1']['lifetime'])
					$racoonconf .= "		lifetime time {$tunnel['p1']['lifetime']} secs;\n";
>>>>>>> FETCH_HEAD

			list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, 'local');
			if ($myid_type != 'address')
				$myid_data = "{$myid_type}:{$myid_data}";

			/* Only specify peer ID if we are not dealing with a mobile PSK-only tunnel */
			$peerid_spec = '';
			if (!isset($ph1ent['mobile'])) {
				list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, 'peer', $rgmap);
				if ($peerid_type != 'address')
					$peerid_spec = "{$peerid_type}:{$peerid_data}";
				else
					$peerid_spec = $peerid_data;
			}

			if (is_array($ph1ent['encryption-algorithm']) && !empty($ph1ent['encryption-algorithm']['name']) && !empty($ph1ent['hash-algorithm'])) {
				$ealgosp1 = '';
				$ealg_id = $ph1ent['encryption-algorithm']['name'];
				$ealg_kl = $ph1ent['encryption-algorithm']['keylen'];
				if ($ealg_kl)
					$ealgosp1 = "ike = {$ealg_id}{$ealg_kl}-{$ph1ent['hash-algorithm']}";
				else
					$ealgosp1 = "ike = {$ealg_id}-{$ph1ent['hash-algorithm']}";

				$modp = vpn_ipsec_convert_to_modp($ph1ent['dhgroup']);
				if (!empty($modp))
					$ealgosp1 .= "-{$modp}";

				$ealgosp1 .= "!";
			}

			if ($ph1ent['dpd_delay'] && $ph1ent['dpd_maxfail']) {
				if ($passive == "route")
					$dpdline = "dpdaction = restart";
				else
					$dpdline = "dpdaction = clear";
				$dpdline .= "\n\tdpddelay = {$ph1ent['dpd_delay']}s";
				$dpdtimeout = $ph1ent['dpd_delay'] * ($ph1ent['dpd_maxfail'] + 1);
				$dpdline .= "\n\tdpdtimeout = {$dpdtimeout}s";
			} else
				$dpdline = "dpdaction = none";

			$ikelifeline = '';
			if ($ph1ent['lifetime'])
				$ikelifeline = "ikelifetime = {$ph1ent['lifetime']}s";

			$rightsourceip = NULL;
			if (isset($ph1ent['mobile']) && !empty($a_client['pool_address'])) 
				$rightsourceip = "\trightsourceip = {$a_client['pool_address']}/{$a_client['pool_netbits']}\n";

			$authentication = "";
			switch ($ph1ent['authentication_method']) {
			case 'eap-mschapv2':
				if (isset($ph1ent['mobile'])) {
					$authentication = "eap_identity=%any\n\t";
					$authentication .= "leftauth=pubkey\n\trightauth=eap-mschapv2";
					if (!empty($ph1ent['certref']))
						$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
				}
				break;
			case 'eap-tls':
				if (isset($ph1ent['mobile'])) {
					$authentication = "eap_identity=%identity\n\t";
					$authentication .= "leftauth=pubkey\n\trightauth=eap-tls";
					if (!empty($ph1ent['certref']))
						$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
				} else {
					$authentication = "leftauth=eap-tls\n\trightauth=eap-tls";
					if (!empty($ph1ent['certref']))
						$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
				}
				break;
			case 'xauth_rsa_server':
				$authentication = "leftauth = pubkey\n\trightauth = pubkey";
				$authentication .= "\n\trightauth2 = xauth-generic";
				if (!empty($ph1ent['certref']))
					$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
				break;
			case 'xauth_psk_server':
				$authentication = "leftauth = psk\n\trightauth = psk";
				$authentication .= "\n\trightauth2 = xauth-generic";
				break;
			case 'pre_shared_key':
				$authentication = "leftauth = psk\n\trightauth = psk";
				break;
			case 'rsasig':
				$authentication = "leftauth = pubkey\n\trightauth = pubkey";
				if (!empty($ph1ent['certref']))
					$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
				break;
			case 'hybrid_rsa_server':
				$authentication = "leftauth = xauth-generic\n\trightauth = pubkey";
				$authentication .= "\n\trightauth2 = xauth";
				if (!empty($ph1ent['certref']))
					$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
				break;
			}

			$left_spec = $ep;

			if (isset($ph1ent['reauth_enable']))
				$reauth = "reauth = no";
			else
				$reauth = "reauth = yes";
			if (isset($ph1ent['rekey_enable']))
				$rekey = "rekey = no";
			else
				$rekey = "rekey = yes";

			if ($ph1ent['nat_traversal'] == 'off')
				$forceencaps = 'forceencaps = no';
			else if ($ph1ent['nat_traversal'] == 'force')
				$forceencaps = 'forceencaps = yes';
			else
				$forceencaps = 'forceencaps = no';

			$ipseclifetime = 0;
			$rightsubnet_spec = array();
			$leftsubnet_spec = array();
			$reqids = array();
			$ealgoAHsp2arr = array();
			$ealgoESPsp2arr = array();
		if (is_array($a_phase2) && count($a_phase2)) {
			foreach ($a_phase2 as $ph2ent) {
				if ($ikeid != $ph2ent['ikeid'])
					continue;

				if (isset($ph2ent['disabled']))
					continue;

				if (isset($ph2ent['mobile']) && !isset($a_client['enable']))
					continue;

				if (($ph2ent['mode'] == 'tunnel') or ($ph2ent['mode'] == 'tunnel6')) {
					$tunneltype = "type = tunnel";

					$localid_type = $ph2ent['localid']['type'];
					$leftsubnet_data = ipsec_idinfo_to_cidr($ph2ent['localid'], false, $ph2ent['mode']);

					/* Do not print localid in some cases, such as a pure-psk or psk/xauth single phase2 mobile tunnel */
					if (($localid_type == "none" || $localid_type == "mobile")
					    && isset($ph1ent['mobile']) && (ipsec_get_number_of_phase2($ikeid)==1)) {
						$left_spec = '%any';
					} else {
						if ($localid_type != "address") {
							$localid_type = "subnet";
						}
						// Don't let an empty subnet into config, it can cause parse errors. Ticket #2201.
						if (!is_ipaddr($leftsubnet_data) && !is_subnet($leftsubnet_data) && ($leftsubnet_data != "0.0.0.0/0")) {
							log_error("Invalid IPsec Phase 2 \"{$ph2ent['descr']}\" - {$ph2ent['localid']['type']} has no subnet.");
							continue;
						}
						if (!empty($ph2ent['natlocalid'])) {
							$natleftsubnet_data =  ipsec_idinfo_to_cidr($ph2ent['natlocalid'], false, $ph2ent['mode']);
							if ($ph2ent['natlocalid']['type'] != "address") {
								if (is_subnet($natleftsubnet_data))
									$leftsubnet_data = "{$natleftsubnet_data}|{$leftsubnet_data}";
							} else {
								if (is_ipaddr($natleftsubnet_data))
									$leftsubnet_data = "{$natleftsubnet_data}|{$leftsubnet_data}";
							}
							$natfilterrules = true;
						}
					}

<<<<<<< HEAD
					$leftsubnet_spec[] = $leftsubnet_data;
=======
				if (isset($tunnel['p1']['myident']['myaddress'])) {
					$myidentt = "address ";
					$myident = $curwanip;
				} else if (isset($tunnel['p1']['myident']['address'])) {
					$myidentt = "address ";
					$myident = $tunnel['p1']['myident']['address'];
				} else if (isset($tunnel['p1']['myident']['fqdn'])) {
					$myidentt = "fqdn ";
					$myident = $tunnel['p1']['myident']['fqdn'];
				} else if (isset($tunnel['p1']['myident']['ufqdn'])) {
					$myidentt = "user_fqdn ";
					$myident = $tunnel['p1']['myident']['ufqdn'];
 				}
				
				$nattline = '';
				if (isset($tunnel['natt'])) {
					//$nattline = "nat_traversal on;";
				}

				$dpdline = '';
				if (is_numeric($tunnel['dpddelay'])) {
					$dpdline = "dpd_delay {$tunnel['dpddelay']};";
				}
>>>>>>> FETCH_HEAD

					if (!isset($ph2ent['mobile'])) {
						$tmpsubnet = ipsec_idinfo_to_cidr($ph2ent['remoteid'], false, $ph2ent['mode']);
						$rightsubnet_spec[] = $tmpsubnet;
					} else if (!empty($a_client['pool_address'])) {
						$rightsubnet_spec[] = "{$a_client['pool_address']}/{$a_client['pool_netbits']}";
					}
				} else {
					$tunneltype = "type = transport";

					if ((($ph1ent['authentication_method'] == "xauth_psk_server") ||
					    ($ph1ent['authentication_method'] == "pre_shared_key")) && isset($ph1ent['mobile'])) {
						$left_spec = "%any";
					} else {
						$tmpsubnet = ipsec_get_phase1_src($ph1ent);
						$leftsubnet_spec[] = $tmpsubnet;
					}

					if (!isset($ph2ent['mobile'])) {
						$rightsubnet_spec[] = $right_spec;
					}
				}

				if (isset($a_client['pfs_group']))
					$ph2ent['pfsgroup'] = $a_client['pfs_group'];

				if ($ph2ent['protocol'] == 'esp') {
					if (is_array($ph2ent['encryption-algorithm-option'])) {
						foreach ($ph2ent['encryption-algorithm-option'] as $ealg) {
							$ealg_id = $ealg['name'];
							$ealg_kl = $ealg['keylen'];

							if (!empty($ealg_kl) && $ealg_kl == "auto") {
								if (empty($p2_ealgos) || !is_array($p2_ealgos))
									require("ipsec.inc");
								$key_hi = $p2_ealgos[$ealg_id]['keysel']['hi'];
								$key_lo = $p2_ealgos[$ealg_id]['keysel']['lo'];
								$key_step = $p2_ealgos[$ealg_id]['keysel']['step'];
								/* XXX: in some cases where include ordering is suspect these variables
								 * are somehow 0 and we enter this loop forever and timeout after 900
								 * seconds wrecking bootup */
								if ($key_hi != 0 and $key_lo !=0 and $key_step !=0) {
									for ($keylen = $key_hi; $keylen >= $key_lo; $keylen -= $key_step) {
										if (!empty($ph2ent['hash-algorithm-option']) && is_array($ph2ent['hash-algorithm-option'])) {
											foreach ($ph2ent['hash-algorithm-option'] as $halgo) {
												$halgo = str_replace('hmac_', '', $halgo);
												$tmpealgo = "{$ealg_id}{$keylen}-{$halgo}";
												$modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']);
												if (!empty($modp))
													$tmpealgo .= "-{$modp}";
												$ealgoESPsp2arr[] = $tmpealgo;
											}
										} else {
											$tmpealgo = "{$ealg_id}{$keylen}";
											$modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']);
											if (!empty($modp))
												$tmpealgo .= "-{$modp}";
											$ealgoESPsp2arr[] = $tmpealgo;
										}
									}
								}
							} else {
								if (!empty($ph2ent['hash-algorithm-option']) && is_array($ph2ent['hash-algorithm-option'])) {
									foreach ($ph2ent['hash-algorithm-option'] as $halgo) {
										$halgo = str_replace('hmac_', '', $halgo);
										$tmpealgo = "{$ealg_id}{$ealg_kl}-{$halgo}";
										$modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']);
										if (!empty($modp))
											$tmpealgo .= "-{$modp}";
										$ealgoESPsp2arr[] = $tmpealgo;
									}
								} else {
									$tmpealgo = "{$ealg_id}{$ealg_kl}";
									$modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']);
									if (!empty($modp))
										$tmpealgo .= "-{$modp}";
									$ealgoESPsp2arr[] = $tmpealgo;
								}
							}
						}
					}
				} else if ($ph2ent['protocol'] == 'ah') {
					if (!empty($ph2ent['hash-algorithm-option']) && is_array($ph2ent['hash-algorithm-option'])) {
						$modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']);
						foreach ($ph2ent['hash-algorithm-option'] as $tmpAHalgo) {
							$tmpAHalgo = str_replace('hmac_', '', $tmpAHalgo);
							if (!empty($modp))
								$tmpAHalgo = "-{$modp}";
							$ealgoAHsp2arr[] = $tmpAHalgo;
						}
					}
				}
<<<<<<< HEAD
=======
				$racoonconf .= <<<EOD
remote anonymous \{
	exchange_mode {$tunnel['p1']['mode']};
	my_identifier {$myidentt}"{$myident}";	
	{$nattline}
	{$certline}
	initial_contact on;
	{$dpdline}
	ike_frag on;
	passive on;
	generate_policy on;
	support_proxy on;
	proposal_check obey;

	proposal \{
		encryption_algorithm {$tunnel['p1']['encryption-algorithm']};
		hash_algorithm {$tunnel['p1']['hash-algorithm']};
		authentication_method {$authmethod};
		dh_group {$tunnel['p1']['dhgroup']};
>>>>>>> FETCH_HEAD

				$reqids[] = $ph2ent['reqid'];

				if (!empty($ph2ent['lifetime'])) {
					if ($ipseclifetime == 0 || intval($ipseclifetime) > intval($ph2ent['lifetime']))
						$ipseclifetime = intval($ph2ent['lifetime']);
				}

			}
		}

			$ipsecconnect =<<<EOD
	fragmentation = yes
	keyexchange = {$keyexchange}
	{$reauth}
	{$forceencaps}
	{$rekey}
	installpolicy = yes
	{$tunneltype}
	{$dpdline}
	auto = {$passive}
	left = {$left_spec}
	right = {$right_spec}
	leftid = {$myid_data}

EOD;

			if (isset($config['ipsec']['compression'])) {
				$ipsecconnect .= "\tcompress = yes\n";
				$enablecompression = true;
			}
			if (!empty($ikelifeline))
				$ipsecconnect .= "\t{$ikelifeline}\n";
			if ($ipseclifetime > 0)
				$ipsecconnect .= "\tlifetime = {$ipseclifetime}s\n";
			if (!empty($rightsourceip))
				$ipsecconnect .= "{$rightsourceip}";
			if (!empty($ealgosp1))
				$ipsecconnect .= "\t{$ealgosp1}\n";
			if (!empty($ealgoAHsp2arr))
				$ipsecconnect .= "\tah = " . join(',', $ealgoAHsp2arr) . "!\n";
			if (!empty($ealgoESPsp2arr))
				$ipsecconnect .= "\tesp = " . join(',', $ealgoESPsp2arr) . "!\n";
			if (!empty($authentication))
				$ipsecconnect .= "\t{$authentication}\n";
			if (!empty($peerid_spec))
				$ipsecconnect .= "\trightid = {$peerid_spec}\n";
			if ($keyexchange == 'ikev1')
				$ipsecconnect .= "\taggressive = {$aggressive}\n";

			if (!isset($ph1ent['mobile']) && $keyexchange == 'ikev1') {
				if (!empty($rightsubnet_spec)) {
					$ipsecfin = '';
					foreach ($rightsubnet_spec as $idx => $rsubnet) {
						$ipsecfin .= "\nconn con{$ph1ent['ikeid']}00{$idx}\n";
						if (!empty($reqids[$idx]))
							$ipsecfin .= "\treqid = " . $reqids[$idx] . "\n";
						$ipsecfin .= $ipsecconnect;
						$ipsecfin .= "\trightsubnet = {$rsubnet}\n";
						$ipsecfin .= "\tleftsubnet = " . $leftsubnet_spec[$idx] . "\n";
					}
				} else
					log_error("No phase2 specifications for tunnel with REQID = {$ikeid}");
			} else {
				$ipsecfin = "\nconn con{$ph1ent['ikeid']}\n";
				if (!empty($reqids[$idx]))
					$ipsecfin .= "\treqid = " . $reqids[0] . "\n";
				$ipsecfin .= $ipsecconnect;
				if (!empty($rightsubnet_spec)) {
					$tempsubnets = array();
					foreach ($rightsubnet_spec as $rightsubnet)
						$tempsubnets[$rightsubnet] = $rightsubnet;
					$ipsecfin .= "\trightsubnet = " . join(",", $tempsubnets) . "\n";
					unset($tempsubnets, $rightsubnet);
				}
				if (!empty($leftsubnet_spec)) {
					$tempsubnets = array();
					foreach ($leftsubnet_spec as $leftsubnet)
						$tempsubnets[$leftsubnet] = $leftsubnet;
					$ipsecfin .= "\tleftsubnet = " . join(",", $leftsubnet_spec) . "\n";
					unset($tempsubnets, $leftsubnet);
				}
			}
			$ipsecconf .= $ipsecfin;
			unset($ipsecfin);

		}
	}

	@file_put_contents("{$g['varetc_path']}/ipsec/ipsec.conf", $ipsecconf);
	unset($ipsecconf);
	/* end ipsec.conf */

	if ($enablecompression === true)
		set_single_sysctl('net.inet.ipcomp.ipcomp_enable', 1);
	else
		set_single_sysctl('net.inet.ipcomp.ipcomp_enable', 0);

	/* mange process */
	if (isvalidpid("{$g['varrun_path']}/charon.pid")) {
		/* Read secrets */
		mwexec("/usr/local/sbin/ipsec rereadall", false);
		/* Update configuration changes */
		mwexec("/usr/local/sbin/ipsec update", false);
	} else {
		mwexec("/usr/local/sbin/ipsec start", false); 
	}

	if ($natfilterrules == true)
		filter_configure();
	/* start filterdns, if necessary */
	if (count($filterdns_list) > 0) {
		$interval = 60;
		if (!empty($ipseccfg['dns-interval']) && is_numeric($ipseccfg['dns-interval']))
			$interval = $ipseccfg['dns-interval'];

		$hostnames = "";
		array_unique($filterdns_list);
		foreach ($filterdns_list as $hostname)
			$hostnames .= "cmd {$hostname} '/usr/local/sbin/pfSctl -c \"service reload ipsecdns\"'\n";
		file_put_contents("{$g['varetc_path']}/ipsec/filterdns-ipsec.hosts", $hostnames);
		unset($hostnames);

		if (isvalidpid("{$g['varrun_path']}/filterdns-ipsec.pid"))
			sigkillbypid("{$g['varrun_path']}/filterdns-ipsec.pid", "HUP");
		else {
			mwexec("/usr/local/sbin/filterdns -p {$g['varrun_path']}/filterdns-ipsec.pid -i {$interval} -c {$g['varetc_path']}/ipsec/filterdns-ipsec.hosts -d 1");
		}
	} else {
		killbypid("{$g['varrun_path']}/filterdns-ipsec.pid");
		@unlink("{$g['varrun_path']}/filterdns-ipsec.pid");
	}

	if (platform_booting())
		echo "done\n";

	return count($filterdns_list);
}

/*
 * Forcefully restart IPsec
 * This is required for when dynamic interfaces reload
 * For all other occasions the normal vpn_ipsec_configure()
 * will gracefully reload the settings without restarting
 */
function vpn_ipsec_force_reload($interface = "") {
	global $g, $config;

	$ipseccfg = $config['ipsec'];

<<<<<<< HEAD
	if (!empty($interface) && is_array($ipseccfg['phase1'])) {
		$found = false;
		foreach ($ipseccfg['phase1'] as $ipsec) {
			if (!isset($ipsec['disabled']) && ($ipsec['interface'] == $interface)) {
				$found = true;
				break;
=======
			if (is_array($ipseccfg['tunnel'])) {
				foreach ($ipseccfg['tunnel'] as $tunnel) {
					if (isset($tunnel['disabled']))
						continue;

					$rgip = $rgmap[$tunnel['remote-gateway']];
					if (!$rgip)
						continue;

					$pskconf .= "{$rgip}     {$tunnel['p1']['pre-shared-key']}\n";
				}
>>>>>>> FETCH_HEAD
			}
		}
		if (!$found) {
			log_error(sprintf(gettext("Ignoring IPsec reload since there are no tunnels on interface %s"), $interface));
			return;
		}
	}

	/* if ipsec is enabled, start up again */
	if (isset($ipseccfg['enable'])) {
		log_error(gettext("Forcefully reloading IPsec"));
		vpn_ipsec_configure();
	}
}

/* master setup for vpn (mpd) */
function vpn_setup() {
	global $g;

<<<<<<< HEAD
	if ($g['platform'] == 'jail')
		return;
=======
			exec("/bin/mkdir -p /var/db/racoon");

			if(is_process_running("racoon")) {
				log_error("IPSEC: Send a reload signal to the IPsec process");
				sleep("0.1");
				mwexec("/usr/local/sbin/racoonctl -s /var/db/racoon/racoon.sock reload-config", false);
				// mwexec("/usr/bin/killall -HUP racoon", false);
			} else {
				/* flush SA + SPD entries */
				mwexec("/usr/local/sbin/setkey -FP", false);
				sleep("0.1");
				mwexec("/usr/local/sbin/setkey -F", false);
				sleep("0.1");
				/* start racoon */
				mwexec("/usr/local/sbin/racoon -f {$g['varetc_path']}/racoon.conf", false);
				sleep("0.1");
				/* load SPD */
				mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false);
				/* We are already online, reload */
				sleep("0.1");
				mwexec("/usr/local/sbin/racoonctl -s /var/db/racoon/racoon.sock reload-config", false);
			}

			/* start dnswatch, if necessary */
			if (count($dnswatch_list) > 0) {
				$interval = 60;
				if ($ipseccfg['dns-interval'])
					$interval = $ipseccfg['dns-interval'];

				$hostnames = "";
				array_unique($dnswatch_list);
				$hostnames = implode("\n", $dnswatch_list);
				$hostnames .= "\n";
				file_put_contents("{$g['varetc_path']}/dnswatch-ipsec.hosts", $hostnames);
				killbypid("{$g['varrun_path']}/dnswatch-ipsec.pid");
				mwexec("/usr/local/sbin/dnswatch {$g['varrun_path']}/dnswatch-ipsec.pid $interval /etc/rc.newipsecdns {$g['varetc_path']}/dnswatch-ipsec.hosts", false);
			}


		}
	}
>>>>>>> FETCH_HEAD

	/* start pptpd */
	vpn_pptpd_configure();

	/* start pppoe server */
	vpn_pppoes_configure();

	/* setup l2tp */
	vpn_l2tp_configure();
}

function vpn_netgraph_support() {
	$iflist = get_configured_interface_list();
	foreach ($iflist as $iface) {
		$realif = get_real_interface($iface);
		/* Get support for netgraph(4) from the nic */
		$ifinfo = pfSense_get_interface_addresses($realif);
		if (!empty($ifinfo) && in_array($ifinfo['iftype'], array("ether", "vlan", "bridge")))
			pfSense_ngctl_attach(".", $realif);
	}
}

function vpn_pptpd_configure() {
	global $config, $g;

	$syscfg = $config['system'];
	$pptpdcfg = $config['pptpd'];

	if (platform_booting()) {
		if (!$pptpdcfg['mode'] || ($pptpdcfg['mode'] == "off"))
			return 0;

		if (platform_booting(true))
			echo gettext("Configuring PPTP VPN service... ");
	} else {
		/* kill mpd */
		killbypid("{$g['varrun_path']}/pptp-vpn.pid");

		/* wait for process to die */
		sleep(3);

		if (is_process_running("mpd -b")) {
			killbypid("{$g['varrun_path']}/pptp-vpn.pid");
			log_error(gettext("Could not kill mpd within 3 seconds.   Trying again."));
		}

		/* remove mpd.conf, if it exists */
		unlink_if_exists("{$g['varetc_path']}/pptp-vpn/mpd.conf");
		unlink_if_exists("{$g['varetc_path']}/pptp-vpn/mpd.links");
		unlink_if_exists("{$g['varetc_path']}/pptp-vpn/mpd.secret");
	}

	if (empty($pptpdcfg['n_pptp_units'])) {
		log_error("Something wrong in the PPTPd configuration. Preventing starting the daemon because issues would arise.");
		return;
	}

	/* make sure pptp-vpn directory exists */
	if (!file_exists("{$g['varetc_path']}/pptp-vpn"))
		mkdir("{$g['varetc_path']}/pptp-vpn");

	switch ($pptpdcfg['mode']) {
		case 'server' :
			/* write mpd.conf */
			$fd = fopen("{$g['varetc_path']}/pptp-vpn/mpd.conf", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.conf in vpn_pptpd_configure().") . "\n");
				return 1;
			}

			$mpdconf = <<<EOD
pptps:

EOD;

			for ($i = 0; $i < $pptpdcfg['n_pptp_units']; $i++) {
				$mpdconf .= "	load pt{$i}\n";
			}

			for ($i = 0; $i < $pptpdcfg['n_pptp_units']; $i++) {

				$clientip = long2ip32(ip2long($pptpdcfg['remoteip']) + $i);

				$mpdconf .= <<<EOD

pt{$i}:
	new -i pptpd{$i} pt{$i} pt{$i}
	set ipcp ranges {$pptpdcfg['localip']}/32 {$clientip}/32
	load pts

EOD;
			}

			$mpdconf .=<<<EOD

pts:
	set iface disable on-demand
	set iface enable proxy-arp
	set iface enable tcpmssfix
	set iface idle 1800
	set iface up-script /usr/local/sbin/vpn-linkup
	set iface down-script /usr/local/sbin/vpn-linkdown
	set bundle enable multilink
	set bundle enable crypt-reqd
	set link yes acfcomp protocomp
	set link no pap chap
	set link enable chap-msv2
	set link mtu 1460
	set link keep-alive 10 60
	set ipcp yes vjcomp
	set bundle enable compression
	set ccp yes mppc
	set ccp yes mpp-e128
	set ccp yes mpp-stateless

EOD;

			if (!isset ($pptpdcfg['req128'])) {
				$mpdconf .=<<<EOD
	set ccp yes mpp-e40
	set ccp yes mpp-e56

EOD;
			}

			if  (isset($pptpdcfg["wins"]) && $pptpdcfg['wins'] != "")
				$mpdconf  .=  "	set ipcp nbns {$pptpdcfg['wins']}\n";

			if (!empty($pptpdcfg['dns1'])) {
				$mpdconf .= "	set ipcp dns " . $pptpdcfg['dns1'];
				if (!empty($pptpdcfg['dns2']))
					$mpdconf .= " " . $pptpdcfg['dns2'];
				$mpdconf .= "\n";
			} elseif (isset ($config['dnsmasq']['enable'])) {
				$mpdconf .= "	set ipcp dns " . get_interface_ip("lan");
				if ($syscfg['dnsserver'][0])
					$mpdconf .= " " . $syscfg['dnsserver'][0];
				$mpdconf .= "\n";
			} elseif (isset($config['unbound']['enable'])) {
				$mpdconf .= "	set ipcp dns " . get_interface_ip("lan");
				if ($syscfg['dnsserver'][0])
					$mpdconf .= " " . $syscfg['dnsserver'][0];
				$mpdconf .= "\n";
			} elseif (is_array($syscfg['dnsserver']) && ($syscfg['dnsserver'][0])) {
					$mpdconf .= "	set ipcp dns " . join(" ", $syscfg['dnsserver']) . "\n";
			}

			if (isset ($pptpdcfg['radius']['server']['enable'])) {
				$authport = (isset($pptpdcfg['radius']['server']['port']) && strlen($pptpdcfg['radius']['server']['port']) > 1) ? $pptpdcfg['radius']['server']['port'] : 1812;
				$acctport = $authport + 1;
				$mpdconf .=<<<EOD
	set radius server {$pptpdcfg['radius']['server']['ip']} "{$pptpdcfg['radius']['server']['secret']}" {$authport} {$acctport}

EOD;
			if (isset ($pptpdcfg['radius']['server2']['enable'])) {
				$authport = (isset($pptpdcfg['radius']['server2']['port']) && strlen($pptpdcfg['radius']['server2']['port']) > 1) ? $pptpdcfg['radius']['server2']['port'] : 1812;
				$acctport = $authport + 1;
				$mpdconf .=<<<EOD
	set radius server {$pptpdcfg['radius']['server2']['ip']} "{$pptpdcfg['radius']['server2']['secret2']}" {$authport} {$acctport}

EOD;
			}
			$mpdconf .=<<<EOD
	set radius retries 3
	set radius timeout 10
	set auth enable radius-auth

EOD;

				if (isset ($pptpdcfg['radius']['accounting'])) {
					$mpdconf .=<<<EOD
	set auth enable radius-acct
	set radius acct-update 300

EOD;
				}
			}

			fwrite($fd, $mpdconf);
			fclose($fd);
			unset($mpdconf);

			/* write mpd.links */
			$fd = fopen("{$g['varetc_path']}/pptp-vpn/mpd.links", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.links in vpn_pptpd_configure().") . "\n");
				return 1;
			}

			$mpdlinks = "";

			for ($i = 0; $i < $pptpdcfg['n_pptp_units']; $i++) {
				$mpdlinks .=<<<EOD

pt{$i}:
	set link type pptp
	set pptp enable incoming
	set pptp disable originate
	set pptp disable windowing

EOD;
			}

			fwrite($fd, $mpdlinks);
			fclose($fd);
			unset($mpdlinks);

			/* write mpd.secret */
			$fd = fopen("{$g['varetc_path']}/pptp-vpn/mpd.secret", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.secret in vpn_pptpd_configure().") . "\n");
				return 1;
			}

			$mpdsecret = "";

			if (is_array($pptpdcfg['user'])) {
				foreach ($pptpdcfg['user'] as $user) {
					$pass = str_replace('\\', '\\\\', $user['password']);
					$pass = str_replace('"', '\"', $pass);
					$mpdsecret .= "{$user['name']} \"{$pass}\" {$user['ip']}\n";
				}
			}

			fwrite($fd, $mpdsecret);
			fclose($fd);
			unset($mpdsecret);
			chmod("{$g['varetc_path']}/pptp-vpn/mpd.secret", 0600);

			vpn_netgraph_support();

			/* fire up mpd */
			mwexec("/usr/local/sbin/mpd4 -b -d {$g['varetc_path']}/pptp-vpn -p {$g['varrun_path']}/pptp-vpn.pid -s pptps pptps");

			break;

		case 'redir' :
			break;
	}

	if (platform_booting())
		echo "done\n";

	return 0;
}

function vpn_pppoes_configure() {
	global $config;

	if (is_array($config['pppoes']['pppoe'])) {
		foreach ($config['pppoes']['pppoe'] as $pppoe)
			vpn_pppoe_configure($pppoe);
	}
}

<<<<<<< HEAD
function vpn_pppoe_configure(&$pppoecfg) {
=======
function vpn_endpoint_determine($tunnel, $curwanip) {
	global $g, $config;

	if(!$tunnel['interface']) {
		return null;
	}
	if(is_ipaddr($curwanip)) {
		if(preg_match("/^carp/i", $tunnel['interface'])) {
			$iface = $tunnel['interface'];
		} else {
			if($config['interfaces'][$tunnel['interface']]['ipaddr'] == "pppoe" OR 
				$config['interfaces'][$tunnel['interface']]['ipaddr'] == "pptp") {
				$iface = "ng0";
			} else {
				$iface = $config['interfaces'][$tunnel['interface']]['if'];
			}
		}
		$oc = $config['interfaces'][$tunnel['interface']];
		/* carp ips, etc */
		$ip = find_interface_ip($iface);
		if($ip)
			return $ip;

		if (isset($oc['enable']) && $oc['if']) {
			return $oc['ipaddr'];
		}
	}
	return null;
}

function vpn_pppoe_configure() {
>>>>>>> FETCH_HEAD
	global $config, $g;

	$syscfg = $config['system'];

	/* create directory if it does not exist */
	if (!is_dir("{$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn"))
		mkdir("{$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn");

	if (platform_booting()) {
		if (!$pppoecfg['mode'] || ($pppoecfg['mode'] == "off"))
			return 0;

		echo gettext("Configuring PPPoE Server service... ");
	} else {
		/* kill mpd */
		killbypid("{$g['varrun_path']}/pppoe{$pppoecfg['pppoeid']}-vpn.pid");

		/* wait for process to die */
		sleep(2);

	}

	switch ($pppoecfg['mode']) {

		case 'server' :

			$pppoe_interface = get_real_interface($pppoecfg['interface']);

			if ($pppoecfg['paporchap'] == "chap")
				$paporchap = "set link enable chap";
			else
				$paporchap = "set link enable pap";

			/* write mpd.conf */
			$fd = fopen("{$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn/mpd.conf", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.conf in vpn_pppoe_configure().") . "\n");
				return 1;
			}
			$mpdconf = "\n\n";
			$mpdconf .= "poes:\n";

			for ($i = 0; $i < $pppoecfg['n_pppoe_units']; $i++) {
				$mpdconf .= "	load poes{$pppoecfg['pppoeid']}{$i}\n";
			}

			for ($i = 0; $i < $pppoecfg['n_pppoe_units']; $i++) {

				$clientip = long2ip32(ip2long($pppoecfg['remoteip']) + $i);

				if (isset($pppoecfg['radius']['radiusissueips']) && isset($pppoecfg['radius']['server']['enable'])) {
					$isssue_ip_type = "set ipcp ranges {$pppoecfg['localip']}/32 0.0.0.0/0";
				} else {
					$isssue_ip_type = "set ipcp ranges {$pppoecfg['localip']}/32 {$clientip}/32";
				}

				$mpdconf .=<<<EOD

poes{$pppoecfg['pppoeid']}{$i}:
	new -i poes{$pppoecfg['pppoeid']}{$i} poes{$pppoecfg['pppoeid']}{$i} poes{$pppoecfg['pppoeid']}{$i}
	{$isssue_ip_type}
	load pppoe_standard

EOD;
			}

			$mpdconf .=<<<EOD

pppoe_standard:
	set bundle no multilink
	set bundle enable compression
	set auth max-logins 1
	set iface up-script /usr/local/sbin/vpn-linkup
	set iface down-script /usr/local/sbin/vpn-linkdown
	set iface idle 0
	set iface disable on-demand
	set iface disable proxy-arp
	set iface enable tcpmssfix
	set iface mtu 1500
	set link no pap chap
	{$paporchap}
	set link keep-alive 60 180
	set ipcp yes vjcomp
	set ipcp no vjcomp
	set link max-redial -1
	set link mtu 1492
	set link mru 1492
	set ccp yes mpp-e40
	set ccp yes mpp-e128
	set ccp yes mpp-stateless
	set link latency 1
	#set ipcp dns 10.10.1.3
	#set bundle accept encryption

EOD;

			if (!empty($pppoecfg['dns1'])) {
				$mpdconf .= "	set ipcp dns " . $pppoecfg['dns1'];
				if (!empty($pppoecfg['dns2']))
					$mpdconf .= " " . $pppoecfg['dns2'];
				$mpdconf .= "\n";
			} elseif (isset ($config['dnsmasq']['enable'])) {
				$mpdconf .= "	set ipcp dns " . get_interface_ip("lan");
				if ($syscfg['dnsserver'][0])
					$mpdconf .= " " . $syscfg['dnsserver'][0];
				$mpdconf .= "\n";
			} elseif (isset ($config['unbound']['enable'])) {
				$mpdconf .= "	set ipcp dns " . get_interface_ip("lan");
				if ($syscfg['dnsserver'][0])
					$mpdconf .= " " . $syscfg['dnsserver'][0];
				$mpdconf .= "\n";
			} elseif (is_array($syscfg['dnsserver']) && ($syscfg['dnsserver'][0])) {
					$mpdconf .= "	set ipcp dns " . join(" ", $syscfg['dnsserver']) . "\n";
			}

			if (isset ($pppoecfg['radius']['server']['enable'])) {
				$radiusport = "";
				$radiusacctport = "";
				if (isset($pppoecfg['radius']['server']['port']))
					$radiusport = $pppoecfg['radius']['server']['port'];
				if (isset($pppoecfg['radius']['server']['acctport']))
					$radiusacctport = $pppoecfg['radius']['server']['acctport'];
				$mpdconf .=<<<EOD
	set radius server {$pppoecfg['radius']['server']['ip']} "{$pppoecfg['radius']['server']['secret']}" {$radiusport} {$radiusacctport}
	set radius retries 3
	set radius timeout 10
	set auth enable radius-auth

EOD;

<<<<<<< HEAD
				if (isset ($pppoecfg['radius']['accounting'])) {
					$mpdconf .=<<<EOD
	set auth enable radius-acct

=======
				if (isset($pppoecfg['radius']['accounting'])) {
					$mpdconf .= <<<EOD
	set bundle enable radius-acct
	set radius acct-update 300
>>>>>>> FETCH_HEAD
EOD;
				}
			}

			fwrite($fd, $mpdconf);
			fclose($fd);
			unset($mpdconf);

			/* write mpd.links */
			$fd = fopen("{$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn/mpd.links", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.links in vpn_pppoe_configure().") . "\n");
				return 1;
			}

			$mpdlinks = "";

			for ($i = 0; $i < $pppoecfg['n_pppoe_units']; $i++) {
				$mpdlinks .=<<<EOD

poes{$pppoecfg['pppoeid']}{$i}:
	set phys type pppoe
	set pppoe iface {$pppoe_interface}
	set pppoe service "*"
	set pppoe disable originate
	set pppoe enable incoming

EOD;
			}

			fwrite($fd, $mpdlinks);
			fclose($fd);
			unset($mpdlinks);

			if ($pppoecfg['username']) {
				/* write mpd.secret */
				$fd = fopen("{$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn/mpd.secret", "w");
				if (!$fd) {
					printf(gettext("Error: cannot open mpd.secret in vpn_pppoe_configure().") . "\n");
					return 1;
				}

				$mpdsecret = "\n\n";

				if (!empty($pppoecfg['username'])) {
					$item = explode(" ", $pppoecfg['username']);
					foreach($item as $userdata) {
						$data = explode(":", $userdata);
						$mpdsecret .= "{$data[0]} \"" . base64_decode($data[1]) . "\" {$data[2]}\n";
					}
				}

				fwrite($fd, $mpdsecret);
				fclose($fd);
				unset($mpdsecret);
				chmod("{$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn/mpd.secret", 0600);
			}

			/* Check if previous instance is still up */
			while (file_exists("{$g['varrun_path']}/pppoe{$pppoecfg['pppoeid']}-vpn.pid") && isvalidpid("{$g['varrun_path']}/pppoe{$pppoecfg['pppoeid']}-vpn.pid"))
				killbypid("{$g['varrun_path']}/pppoe{$pppoecfg['pppoeid']}-vpn.pid");

			/* Get support for netgraph(4) from the nic */
			pfSense_ngctl_attach(".", $pppoe_interface);
			/* fire up mpd */
			mwexec("/usr/local/sbin/mpd4 -b -d {$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn -p {$g['varrun_path']}/pppoe{$pppoecfg['pppoeid']}-vpn.pid -s poes poes");

			break;
	}

	if (platform_booting())
		echo gettext("done") . "\n";

	return 0;
}

function vpn_l2tp_configure() {
	global $config, $g;

	$syscfg = $config['system'];
	$l2tpcfg = $config['l2tp'];

	/* create directory if it does not exist */
	if (!is_dir("{$g['varetc_path']}/l2tp-vpn"))
		mkdir("{$g['varetc_path']}/l2tp-vpn");

	if (platform_booting()) {
		if (!$l2tpcfg['mode'] || ($l2tpcfg['mode'] == "off"))
			return 0;

		echo gettext("Configuring l2tp VPN service... ");
	} else {
		/* kill mpd */
		killbypid("{$g['varrun_path']}/l2tp-vpn.pid");

		/* wait for process to die */
		sleep(8);

	}

	/* make sure l2tp-vpn directory exists */
	if (!file_exists("{$g['varetc_path']}/l2tp-vpn"))
		mkdir("{$g['varetc_path']}/l2tp-vpn");

	switch ($l2tpcfg['mode']) {

		case 'server' :
			if ($l2tpcfg['paporchap'] == "chap")
				$paporchap = "set link enable chap";
			else
				$paporchap = "set link enable pap";

			/* write mpd.conf */
			$fd = fopen("{$g['varetc_path']}/l2tp-vpn/mpd.conf", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.conf in vpn_l2tp_configure().") . "\n");
				return 1;
			}
			$mpdconf = "\n\n";
			$mpdconf .=<<<EOD
l2tps:

EOD;

			for ($i = 0; $i < $l2tpcfg['n_l2tp_units']; $i++) {
				$mpdconf .= "	load l2tp{$i}\n";
			}

			for ($i = 0; $i < $l2tpcfg['n_l2tp_units']; $i++) {

				$clientip = long2ip32(ip2long($l2tpcfg['remoteip']) + $i);

				if (isset ($l2tpcfg['radius']['radiusissueips']) && isset ($l2tpcfg['radius']['enable'])) {
					$isssue_ip_type = "set ipcp ranges {$l2tpcfg['localip']}/32 0.0.0.0/0";
				} else {
					$isssue_ip_type = "set ipcp ranges {$l2tpcfg['localip']}/32 {$clientip}/32";
				}

				$mpdconf .=<<<EOD

l2tp{$i}:
	new -i l2tp{$i} l2tp{$i} l2tp{$i}
	{$isssue_ip_type}
	load l2tp_standard

EOD;
			}

			$mpdconf .=<<<EOD

l2tp_standard:
	set bundle disable multilink
	set bundle enable compression
	set bundle yes crypt-reqd
	set ipcp yes vjcomp
	# set ipcp ranges 131.188.69.161/32 131.188.69.170/28
	set ccp yes mppc
	set iface disable on-demand
	set iface enable proxy-arp
	set iface up-script /usr/local/sbin/vpn-linkup
	set iface down-script /usr/local/sbin/vpn-linkdown
	set link yes acfcomp protocomp
	set link no pap chap
	set link enable chap
	set link keep-alive 10 180

EOD;

			if (is_ipaddr($l2tpcfg['wins'])) {
				$mpdconf .= "	set ipcp nbns {$l2tpcfg['wins']}\n";
			}
			if (is_ipaddr($l2tpcfg['dns1'])) {
				$mpdconf .= "	set ipcp dns " . $l2tpcfg['dns1'];
				if (is_ipaddr($l2tpcfg['dns2']))
					$mpdconf .= " " . $l2tpcfg['dns2'];
				$mpdconf .= "\n";
			} elseif (isset ($config['dnsmasq']['enable'])) {
				$mpdconf .= "	set ipcp dns " . get_interface_ip("lan");
				if ($syscfg['dnsserver'][0])
					$mpdconf .= " " . $syscfg['dnsserver'][0];
				$mpdconf .= "\n";
			} elseif (isset ($config['unbound']['enable'])) {
				$mpdconf .= "	set ipcp dns " . get_interface_ip("lan");
				if ($syscfg['dnsserver'][0])
					$mpdconf .= " " . $syscfg['dnsserver'][0];
				$mpdconf .= "\n";
			} elseif (is_array($syscfg['dnsserver']) && ($syscfg['dnsserver'][0])) {
					$mpdconf .= "	set ipcp dns " . join(" ", $syscfg['dnsserver']) . "\n";
			}

			if (isset ($l2tpcfg['radius']['enable'])) {
				$mpdconf .=<<<EOD
	set radius server {$l2tpcfg['radius']['server']} "{$l2tpcfg['radius']['secret']}"
	set radius retries 3
	set radius timeout 10
	set auth enable radius-auth

EOD;

				if (isset ($l2tpcfg['radius']['accounting'])) {
					$mpdconf .=<<<EOD
	set auth enable radius-acct

EOD;
				}
			}

			fwrite($fd, $mpdconf);
			fclose($fd);
			unset($mpdconf);

			/* write mpd.links */
			$fd = fopen("{$g['varetc_path']}/l2tp-vpn/mpd.links", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.links in vpn_l2tp_configure().") . "\n");
				return 1;
			}

			$mpdlinks = "";

			for ($i = 0; $i < $l2tpcfg['n_l2tp_units']; $i++) {
				$mpdlinks .=<<<EOD

l2tp{$i}:
	set link type l2tp
	set l2tp enable incoming
	set l2tp disable originate

EOD;
			if (!empty($l2tpcfg['secret']))
					$mpdlinks .= "set l2tp secret {$l2tpcfg['secret']}\n";
			}

			fwrite($fd, $mpdlinks);
			fclose($fd);
			unset($mpdlinks);

			/* write mpd.secret */
			$fd = fopen("{$g['varetc_path']}/l2tp-vpn/mpd.secret", "w");
			if (!$fd) {
				printf(gettext("Error: cannot open mpd.secret in vpn_l2tp_configure().") . "\n");
				return 1;
			}

			$mpdsecret = "\n\n";

			if (is_array($l2tpcfg['user'])) {
				foreach ($l2tpcfg['user'] as $user)
					$mpdsecret .= "{$user['name']} \"{$user['password']}\" {$user['ip']}\n";
			}

			fwrite($fd, $mpdsecret);
			fclose($fd);
			unset($mpdsecret);
			chmod("{$g['varetc_path']}/l2tp-vpn/mpd.secret", 0600);

			vpn_netgraph_support();

			/* fire up mpd */
			mwexec("/usr/local/sbin/mpd4 -b -d {$g['varetc_path']}/l2tp-vpn -p {$g['varrun_path']}/l2tp-vpn.pid -s l2tps l2tps");

			break;

		case 'redir' :
			break;
	}

	if (platform_booting())
		echo "done\n";

	return 0;
}

<<<<<<< HEAD
function vpn_ipsec_configure_preferoldsa() {
	global $config;
	if(isset($config['ipsec']['preferoldsa']))
		set_single_sysctl("net.key.preferred_oldsa", "-30");
	else
		set_single_sysctl("net.key.preferred_oldsa", "0");
=======
/* Forcefully restart IPSEC
 * This is required for when dynamic interfaces reload
 * For all other occasions the normal vpn_ipsec_configure()
 * will gracefully reload the settings without restarting
 */
function vpn_ipsec_force_reload() {
	global $config;
	global $g;

	$ipseccfg = $config['ipsec'];

	/* kill racoon */
	if(is_process_running("racoon"))
		mwexec("/usr/bin/killall racoon", true);

	/* wait for process to die */
	sleep(4);

	/* send a SIGKILL to be sure */
	sigkillbypid("{$g['varrun_path']}/racoon.pid", "KILL");

	/* wait for flushing to finish */
	sleep(1);

	/* if ipsec is enabled, start up again */
	if (isset($ipseccfg['enable'])) {
		log_error("Forcefully reloading IPSEC racoon daemon");
		vpn_ipsec_configure();
	}

}

/* Walk the tunnels for hostname endpoints. If the hostnames 
 * resolve to a different IP now compared to the DNS cache
 * we reload the policies if the endpoint has changed */
function vpn_ipsec_refresh_policies() {
	global $config;
	global $g;

	$ipseccfg = $config['ipsec'];

	if (! isset($ipseccfg['enable'])) {
		return true;
	}

	/* Walk the Ipsec tunnel array */
	if (is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) {
		foreach ($ipseccfg['tunnel'] as $tunnel) {
			if (isset($tunnel['disabled'])) {
				continue;
			}
			if (is_ipaddr($tunnel['remote-gateway'])) {
				continue;
			}

			if (!is_ipaddr($tunnel['remote-gateway'])) {
				$dnscache = compare_hostname_to_dnscache($tunnel['remote-gateway']);
				$dnscache = trim($dnscache);
				/* we should have the old IP addresses in the dnscache now */
				if($dnscache <> "") {
					$oldtunnel = $tunnel;
					$oldtunnel['remote-gateway'] = trim($dnscache);
					reload_tunnel_spd_policy ($tunnel, $oldtunnel);
				}
			}
		}
	}

	/* process all generated spd.conf files from tmp which are left behind
	 * behind by either changes of dynamic tunnels or manual edits
	 * scandir() is only available in PHP5 */
	$tmpfiles = array();
	$dh  = opendir($g['tmp_path']);
	while (false !== ($filename = readdir($dh))) {
		$tmpfiles[] = $filename;
	}
	sort($tmpfiles);
	foreach($tmpfiles as $tmpfile) {
		if(preg_match("/^spd.conf./", $tmpfile)) {
			$ret = mwexec("/usr/local/sbin/setkey -f {$g['tmp_path']}/{$tmpfile} 2>&1", false);
			if($ret == 0) {
				unlink("{$g['tmp_path']}/{$tmpfile}");
			} else {
				rename("{$g['tmp_path']}/{$tmpfile}", ("{$g['tmp_path']}/failed.{$tmpfile}"));
			}
		}
	}
}

function reload_tunnel_spd_policy($tunnel, $oldtunnel) {
	global $config;
	global $g;

	/* if we are not passed a old tunnel array we create one */
	if(empty($oldtunnel)) {
		$oldtunnel = $tunnel;
	}

	$curwanip = get_current_wan_address();
	$sad_arr = return_ipsec_sad_array();

	$ep = vpn_endpoint_determine($tunnel, $curwanip);
	vpn_localnet_determine($tunnel['local-subnet'], $sa, $sn);

	/* make sure we pass the oldtunnel array with a IP for the remote gw */
	$oldgw = trim($oldtunnel['remote-gateway']);
	$oldep = vpn_endpoint_determine($oldtunnel, $curwanip);
	vpn_localnet_determine($oldtunnel['local-subnet'], $oldsa, $oldsn);

	/* see if this tunnel has a hostname for the remote-gateway, and if so,
	 * try to resolve it now and add it to the list for dnswatch */
	if (!is_ipaddr($tunnel['remote-gateway'])) {
		$rgip = resolve_retry($tunnel['remote-gateway']);
		if (!$rgip) {
			log_error("Could not determine VPN endpoint for {$tunnel['descr']}");
			return false;
		}
	} else {
		$rgip = $tunnel['remote-gateway'];
	}
	if (!$ep) {
		log_error("Could not determine VPN endpoint for {$tunnel['descr']}");
		return false;
	}

	$spdconf = "";

	/* Delete old SPD policies if there are changes between the old and new */
 	if(($tunnel != $oldtunnel) && (is_ipaddr($oldgw)) || $tunnel['disabled']) {
		$spdconf .= "spddelete {$oldsa}/{$oldsn} " .
			"{$oldtunnel['remote-subnet']} any -P out ipsec " .
			"{$oldtunnel['p2']['protocol']}/tunnel/{$oldep}-" .
			"{$oldgw}/unique;\n";
		$spdconf .= "spddelete {$oldtunnel['remote-subnet']} " .
			"{$oldsa}/{$oldsn} any -P in ipsec " .
			"{$oldtunnel['p2']['protocol']}/tunnel/{$oldgw}-" .
			"{$oldep}/unique;\n";

		/* zap any existing SA entries */
		foreach($sad_arr as $sad) {
			if(($sad['dst'] == $oldep) && ($sad['src'] == $oldgw)) {
				$spdconf .= "delete {$oldep} {$oldgw} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
			}
			if(($sad['src'] == $oldep) && ($sad['dst'] == $oldgw)) {
				$spdconf .= "delete {$oldgw} {$oldep} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
			}
		}
	}

	if (!$tunnel['disabled']){
		/* Create new SPD entries for the new configuration */
		/* zap any existing SA entries beforehand */
		foreach($sad_arr as $sad) {
			if(($sad['dst'] == $ep) && ($sad['src'] == $rgip)) {
				$spdconf .= "delete {$rgip} {$ep} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
			}
			if(($sad['src'] == $ep) && ($sad['dst'] == $rgip)) {
				$spdconf .= "delete {$ep} {$rgip} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
			}
		}
		/* add new SPD policies to replace them */
		$spdconf .= "spdadd {$sa}/{$sn} " .
			"{$tunnel['remote-subnet']} any -P out ipsec " .
			"{$tunnel['p2']['protocol']}/tunnel/{$ep}-" .
			"{$rgip}/unique;\n";
		$spdconf .= "spdadd {$tunnel['remote-subnet']} " .
			"{$sa}/{$sn} any -P in ipsec " .
			"{$tunnel['p2']['protocol']}/tunnel/{$rgip}-" .
			"{$ep}/unique;\n";
	}

	log_error("Reloading IPsec tunnel '{$tunnel['descr']}'. Previous IP '{$oldgw}', current IP '{$rgip}'. Reloading policy");

	$now = time();
	$spdfile = tempnam("{$g['tmp_path']}", "spd.conf.reload.{$now}.");
	/* generate temporary spd.conf */
	file_put_contents($spdfile, $spdconf);
	return true;
}

/* Dump SAD database to array */
function return_ipsec_sad_array() {
	/* query SAD */
	$fd = @popen("/usr/local/sbin/setkey -D", "r");
	$sad = array();
	if ($fd) {
	        while (!feof($fd)) {
	                $line = chop(fgets($fd));
       	         if (!$line)
       	                 continue;
       	         if ($line == "No SAD entries.")
       	                 break;
       	         if ($line[0] != "\t") {
       	                 if (is_array($cursa))
       	                         $sad[] = $cursa;
       	                 $cursa = array();
       	                 list($cursa['src'],$cursa['dst']) = explode(" ", $line);
        	                $i = 0;
        		        } else {
                        $linea = explode(" ", trim($line));
                        if ($i == 1) {
                                $cursa['proto'] = $linea[0];
                                $cursa['spi'] = substr($linea[2], strpos($linea[2], "x")+1, -1);
                        } else if ($i == 2) {
                                $cursa['ealgo'] = $linea[1];
                        } else if ($i == 3) {
                                $cursa['aalgo'] = $linea[1];
                        }
                }
                $i++;
        }
        if (is_array($cursa) && count($cursa))
                $sad[] = $cursa;
        pclose($fd);
	}
	return($sad);
>>>>>>> FETCH_HEAD
}

?>
